CVE-2026-7406CWE-822

CVE-2026-7406

High · published August 7, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-08-07T02:18Z
Affected products (14)
ProductVersionsFixed in
autodesk/advance_steel≥ 2027, < 2027.12027.1
autodesk/autocad≥ 2027, < 2027.12027.1
autodesk/autocad_architecture≥ 2027, < 2027.12027.1
autodesk/autocad_electrical≥ 2027, < 2027.12027.1
autodesk/autocad_lt≥ 2027, < 2027.12027.1
autodesk/autocad_map_3d≥ 2027, < 2027.12027.1
autodesk/autocad_mechanical≥ 2027, < 2027.12027.1
autodesk/autocad_mep≥ 2027, < 2027.12027.1
autodesk/autocad_plant_3d≥ 2027, < 2027.12027.1
autodesk/civil_3d≥ 2027, < 2027.12027.1
autodesk/dwg_trueview≥ 2027, < 2027.12027.1
autodesk/revit≥ 2025, < 2025.3.52025.3.5
autodesk/revit≥ 2026, < 2026.52026.5
autodesk/revit≥ 2027, < 2027.12027.1
References (2)
https://www.autodesk.com/products/autodesk-access/overview · [email protected]https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012 · [email protected]
EPSS history
Timeline
  • 06 AUG 16:31Z
    BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
    cvelistv5